Two ways out of the Codex sandbox, both fixed, both with the same shape

Accomplish, which sells VM-isolated agent execution, reports two escapes from the OpenAI Codex sandbox, both disclosed to OpenAI on August 12 and, by the author's account, fixed within eight days. The first, which the firm calls Overpatch, is in the open-source Codex CLI: the apply_patch tool granted write access to the parent folder of each path in a patch, so a patch entry naming /tmp widened the grant to the whole disk, and a second entry could then write through a symlink into the home directory in normal workspace-write mode with no approval prompt. The second, Heapjack, is in the node_repl tool that Codex Desktop installs into the global config without an opt-in. Trusted and untrusted JavaScript shared one V8 heap, so untrusted code could take a heap snapshot, recover the per-run authorization token, and send its own requests to the unsandboxed native parent. The author says this ran at read-only, the strictest mode, and ended in unsandboxed command execution: "Open a cloned repo in Codex in read-only sandbox mode, ask it a question, and whoever wrote that repository gets unsandboxed command execution." The fixed versions named in the post are Codex CLI 0.149.0 and Codex Desktop build 26.818.21641; the newest entry on the Codex changelog is CLI 0.155.0, dated September 17. The post is also the vendor's case for its own product, and the fixes have not been verified here beyond the author's account.

Why it matters: In the author's own framing, both bugs put the thing doing the enforcement inside the thing being enforced: a tool that computed its own permissions from its input, and a secret kept in the memory of the code it was meant to exclude. That is the check to run on any harness sandbox you depend on, whoever wrote it.